casual_malware

enabling macros since 2018

[casual_malware @casual_malware]

#covid19 #malspam #nanocore

"Supplier-Face Mask Forehead Thermometer.pdf.exe"
https://t.co/X3G2IpClfB

[casual_malware @casual_malware]

more #covid19 #malspam #agenttesla

"Supplier-Face Mask Forehead Thermometer.exe"
md5: 54f367d16c7acc4f9c4ace73d7eef62a
us2.smtp.mailhostbox[.]com

https://t.co/iAM9AFOh2J

[Anuj Soni @asoni]

Got a chance to submit a few samples to https://t.co/rnWknh72ZO today (automated malware unpacker). Worked great, thanks for the hard work @seanmw and @herrcore!

[casual_malware @casual_malware]

@jstrosch Quite the haul!

#agenttesla x 11
#formbook x 5
#azorult x 1
#remcos #rat x 1
#hawkeye #keylogger 1

paste with hashes: https://t.co/Rr0pWyyEwn

[casual_malware @casual_malware]

#malspam #opendir #lokibot & #agenttesla

http://sylvaclouds[.]eu/bbb/

[casual_malware @casual_malware]

@jstrosch

[casual_malware @casual_malware]

cc: @James_inthe_box @JAMESWT_MHT @wwp96 @1ZRR4H @malwrhunterteam

[casual_malware @casual_malware]

the "baixar-conversa" #metamorfo campaign I have been observing switched over to a #covid19 theme last night. same old metamorfo.

Subject: "IMPORTANTE - COVID-19 (CORONA VIRUS)"
http://www.arjoflos[.]com/upcloud4→
Visualizar_Arquivo43217.zip→
Visualizar_Arquivo4321757JZ.msi

[casual_malware @casual_malware]

Visualizar_Arquivo43217.zip md5:
7e9490c396f372bcd093f21abae9a716

Visualizar_Arquivo4321757JZ.msi md5: f70ca5997caa3d837cd939c8ef56e6ef

https://t.co/O0u4xi7E96

[casual_malware @casual_malware]

#malspam
UPS Customer Service Email spoof→
UPS_DETAILS.IMG→
2x #quasar #rat
file1.exe (040418576ceeca4f3cd5443f29d391ad)
file2.exe (f1f9a82e77c9ed6db052b3bfb929c266)
→
ikorodu.duckdns[.]org

https://t.co/pWEYSwf1da
https://t.co/qZ24dIGm0C
@James_inthe_box @wwp96 @JAMESWT_MHT

[casual_malware @casual_malware]

@hatching_io https://t.co/lg9WjtiypR :)

[casual_malware @casual_malware]

#malspam #quasar #rat

"invoice.exe"
md5: 6372bc859d9ec66daed696aa8cbae7e7
u863495.awsmppl[.]com
185.140.53.106

https://t.co/SXIxrAHBWo

[Germán Fernández @1ZRR4H]

#Metamorfo ocupa la indexación de Google a su favor y logra mayor propagación a través de la copia de noticias desde medios oficiales, ahora suplantando a @elmundoes

Logré acceso al contador de visitas 😅

Listado de IOC's -> https://t.co/IUDI2nnRKm

#malcovid19 #CiberCOVID19

[casual_malware @casual_malware]

#malspam #hawkeye #keylogger

"SCAN001.exe"
md5: 8a5867be14ac55f133f64e6234f2d2f7
mail.djindustries[.]net
198.57.149.45:587

https://t.co/zb5JXDGMKz

[casual_malware @casual_malware]

diff https://t.co/Xaezlp2aGw

[casual_malware @casual_malware]

#malspam #hawkeye #keylogger

"07675566556 PURCHASE ORDERpdf.exe"
md5: b274988968c4256575dd4c4403838324
ftp.gracexmhk[.]info
104.194.9[.]169:21

https://t.co/bBgHjGKh0q

[casual_malware @casual_malware]

https://t.co/qvZUYkXxIe @hatching_io no win7 detection on this one

[casual_malware @casual_malware]

#malspam #agenttesla

"Transfer Request Form.exe"
md5: 189eecdfded79d51c9160af252614a3b
mail.pptoursperu[.]com
209.182.200.130

https://t.co/1iLqMYx6Mq

[casual_malware @casual_malware]

@1ZRR4H @Dkavalanche @malwrhunterteam @Bank_Security @dimitribest @assolini uno más #coronavirus #metamorfo

http://elmundos[.]xyz/coro/→
http://www.mediafire[.]com/file/pu03ma68y6d764k/NXHCCK16779KDII.zip

https://t.co/3yl1efsMNC
md5: b2973893f869c23cde0eac68e4926dff

NXHCCK16779KDII.msi
md5: f55582a7199363f71c0e79a191197e60

202.29.83.151

[casual_malware @casual_malware]

@1ZRR4H @Dkavalanche @malwrhunterteam @Bank_Security @dimitribest @assolini updated list of #metamorfo urls I've seen over the past few days: https://t.co/X6uWtO4k6y I have not seen any of the metamorfo coronavirus malspam.